Post-IPO, Facebook will have to make privacy investigations public

When it comes to information privacy concerns, Facebook already has a bullseye on its back. That won't change now that Facebook is going public in its highly anticipated Initial Public Offering (IPO). But disclosure rules affecting publicly traded companies may force Facebook to reveal privacy-related investigations that it otherwise might have kept secret.

Facebook won't face any new regulations or government oversight specifically related to privacy, according to the experts who spoke to Ars. But in the cases of inquiries from the Federal Trade Commission or attorneys general, investigations that might otherwise remain private would become public because Facebook will be forced to disclose events that could have a material impact on earnings.

Still, it is possible for private companies to keep investigations secret in cases where public companies cannot, because the FTC does not announce investigations before they are concluded, and may not announce them at all, said Jules Polonetsky, director of the Future of Privacy Forum and former Chief Privacy Officer for both AOL and DoubleClick. Various quarterly and annual filings with the Securities and Exchange Commission must inform the public about risks potentially affecting earnings, which may include investigations into privacy practices.

"When I was at DoubleClick many years ago, before I got there, they had to announce their FTC inquiry because they felt it was a significant, material event, even though the FTC wasn't making any announcements and in the end closed the inquiry," Polonetsky told Ars. "But they had to disclose it and it kicked off a lot of attention."

Facebook IPO discusses potential privacy risks

"The FTC and DPC (Irish Data Protection Commissioner) have investigated and audited aspects of our products and practices, and we expect to continue to be the subject of regulatory investigations and audits in the future by these and other regulators throughout the world," Facebook's filing states.

"It is possible that a regulatory inquiry might result in changes to our policies or practices. Violation of existing or future regulatory orders or consent decrees could subject us to substantial monetary fines and other penalties that could negatively affect our financial condition and results of operations. In addition, it is possible that future orders issued by, or enforcement actions initiated by, regulatory authorities could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business."

The Facebook filing also lists various risk factors that could affect its profitability, including new data protection laws being considered in Europe that would mandate "more stringent operational requirements for data processors and significant penalties for non-compliance." Facebook also notes there are legislative proposals in the US at the state and federal level that could similarly harm its business.

Facebook further states its business could be harmed by "system failures or breaches of security or privacy… changes in the legislative or regulatory environment, including with respect to privacy, or enforcement by government regulators, including fines, orders, or consent decree… [or] changes in user sentiment about the quality or usefulness of our products or concerns related to privacy and sharing, safety, security, or other factors."

The requirement that Facebook must disclose privacy investigations (at least the ones that are considered material to its business) aren't a result of specific privacy laws. Rather, public companies must disclose any adverse event, Polonetsky noted. (For an oil company, that could be an oil spill.) As Facebook is a large handler of private user data, investigations into how it handles that data is among the biggest risks it faces.

Still, it is not always clear as to whether something must be disclosed. Polonetsky pointed out that there were claims from investors over whether Apple should disclose more information about the health of Steve Jobs before his death in October of 2011. AOL was forced into a settlement after accusations that it artificially inflated its value prior to the 2000 merger with Time Warner with accounting tricks that hid problems in its ad business.

To follow the law, public companies must tell shareholders of risks in many of these cases. But before an IPO, "There is no particular obligation to report on anything. … For example if one had an FTC inquiry, if I'm a private company, the FTC is not announcing it, and if it doesn't leak no one knows about it," Polonetsky says. "It maybe goes away, it maybe doesn't become public. There are lots of investigations that don't become public because the FTC just asks some questions and not everything leads to something significant."

Public or not, Facebook is a lightning rod

Facebook would have continued to receive heavy scrutiny even if it hadn't filed for an IPO, according to Justin Brookman, former Internet Bureau chief at the New York Attorney General's office and current director of the Project on Consumer Privacy at the Center for Democracy & Technology. The FTC settlement that Facebook signed as a private company will allow the FTC to impose substantial financial penalties against Facebook if it violates privacy laws, he noted. "As far as going public I don't think there exists much difference in the level of scrutiny levied at Google, who is public, and Facebook, who isn't," Brookman told Ars. "I don't think it will change much."

"It's hard to imagine Facebook having more of a target on their backs than they already do," Brookman said. "They have access to so much data, they're going to continue to be the focus of a lot of privacy debates."

I'm considering dumping FB after they force you to change to timeline. I don't really want my employer or co-workers to see what I do in my spare time. It would be like Mike Phelps all over again.

Just like Google, you are the product they are selling. You aren't a 'User'. You are a bit of data for sale. Don't ever put anything up that you wouldn't want an employer or a prospective employer or client to see. It's just that simple. While I use Facebook I keep my profile squeaky clean and not incriminating in any way.

I'm considering dumping FB after they force you to change to timeline. I don't really want my employer or co-workers to see what I do in my spare time. It would be like Mike Phelps all over again.

Just like Google, you are the product they are selling. You aren't a 'User'. You are a bit of data for sale. Don't ever put anything up that you wouldn't want an employer or a prospective employer or client to see. It's just that simple. While I use Facebook I keep my profile squeaky clean and not incriminating in any way.

Facebook deserves to have a privacy target on its back. You need a Hazmat suit on just to negotiate the place safely.

Rant: can you say "Internet bubble 2.0?" Facebook's IPO valuation is somewhere north of 75 billion dollars. Un-f*cking-believable. Five years from now, everybody is going to be talking about what bust Facebook's IPO turned out to be, just like they did for the Time-Warner/AOL merger, which was a complete crock. Steve Case made off like a bandit, and so will Zuckerberg. And for what? For a walled Internet garden which is like the biggest lounge in the world, one filled with every major company on the planet, and each one with an army of representatives saying "Friend us!" Is this what enterprise in America has become?

Rant: can you say "Internet bubble 2.0?" Facebook's IPO valuation is somewhere north of 75 billion dollars. Un-f*cking-believable. Five years from now, everybody is going to be talking about what bust Facebook's IPO turned out to be, just like they did for the Time-Warner/AOL merger, which was a complete crock.

It appears that each new generation has to learn, firsthand, the mistakes of the earlier ones.

In this case the 'generations' are ten years apart, eventually shrinking to the horizon of the average attention span.

I think the reason FB might be successful is because they are integrated into so many third party sites while removing the anonymous profiles so businesses can track your movements. Almost every major website that I frequent has an option to log in or create an account using FB. There are job boards, restaurants, newspapers, blogs, etc. that transmit your user data and browsing habits to FB.

I believe that even Google would love to get their hands on some of that data if given the chance. If FB can develop a reliable method to monetize all of that information without running afoul of privacy laws they will be successful.

Anyway, this is just one person's opinion and I hope I'm wrong about the future integration of FB into most of the web. If that happens, FB would be the de facto standard for identifying and tracking users on the web.

I think the reason FB might be successful is because they are integrated into so many third party sites while removing the anonymous profiles so businesses can track your movements. Almost every major website that I frequent has an option to log in or create an account using FB. There are job boards, restaurants, newspapers, blogs, etc. that transmit your user data and browsing habits to FB.

To a lesser extent this has happened before. Remember when ads used to publish AOL Keywords in the corner? I think MSN and Yahoo attempted to do similar cross-site data exchange back in their heyday. And of course the ubiquitous PayPal button links you from each supporting site to theirs.

Data mining will only get worse now that there's almost no reason to throw data away, and the computational resources needed to churn through all the bits get ever more powerful. What seemed comically Orwellian a decade ago is now a looming reality, only instead of The Government watching you it is The Corporations.

Buckminster Fuller saved every receipt, note, drawing, and other record that passed through his hands at one point in his life (the Dymaxion Chronofile), in an effort to record a human's history from a document perspective. At the time (1915-1983) it seemed like a rather eccentric exercise. Now it seems downright quaint and a duplication of effort.

Facebook deserves to have a privacy target on its back. You need a Hazmat suit on just to negotiate the place safely.

Rant: can you say "Internet bubble 2.0?" Facebook's IPO valuation is somewhere north of 75 billion dollars. Un-f*cking-believable. Five years from now, everybody is going to be talking about what bust Facebook's IPO turned out to be, just like they did for the Time-Warner/AOL merger, which was a complete crock. Steve Case made off like a bandit, and so will Zuckerberg. And for what? For a walled Internet garden which is like the biggest lounge in the world, one filled with every major company on the planet, and each one with an army of representatives saying "Friend us!" Is this what enterprise in America has become?

You have to keep in mind that American society is one that glorifies three things and not one of them is ethical business, hard sciences, etc. Those three things are (1) sports, (2) mediocrity, (3) downright stupidity, and screw you for thinking otherwise!